pratyush/arch-conf-install
Archived
1
0
Fork 0
Code Issues 5 Pull Requests Projects 1 Releases Wiki Activity

add auditd docs

Browse Source
This commit is contained in:
Pratyush Desai 2021-12-09 03:35:43 +05:30
parent c3e200aa04
commit ff8227414c
Signed by: pratyush
GPG Key ID: DBA5BB7505946FAD
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
services/nftables/audit-framework/audit.md Normal file
View File

@ -0,0 +1,13 @@
# Audit Framework
## Kernel
To ensure that all process which may have started before `auditd` are marked as auditable use boot time kernel param `audit=1`.
## Userspace
* Install the `audit` package, enable and start the `auditd.service`.
* The config file is `auditd.conf`.
* The rules are defined in `/etc/audit/audit.rules`.
* `auditctl` can be used to edit rules on the fly.
* `ausearch` and `aureport` are used to summarize and view data.